Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The shift from NIST SP 800-171 revision 2 to revision 3 includes a lot of changes, which we've already covered from a bird's-eye view over in this post. One of the biggest changes in Rev 3 is the introduction of ODPs, or Organization-Defined Parameters. These are very important for compliance with CMMC moving forward, but they're still something of a mystery to some security professionals, and are worth explaining. What are they, how do you define them, and how do you use them for compliance?

One of the jobs of the National Institute of Standards and Technology is to keep on top of new technologies as they are developed and evolve. This is particularly important for risk management, considering both of the major governmental information security frameworks (FedRAMP and CMMC) are based on NIST publications. Well, as you might imagine, Artificial Intelligence technology is a huge new risk factor.

Earning the CMMC certification is the most important step between many businesses and the wealth of lucrative DoD contracts available across a wide range of industries. If you want your business to take that next step, it can be an excellent idea, but it's not a switch you can flip and have operational right away. These things take time, and time is money. The contracts you want could be gone by the time you're done. Your budget for implementation could run out before the work is finished.

In the past, FedRAMP has used impact levels as a sort of classification system for cloud services that wish to work with the government in some capacity. The impact levels evaluate a cloud service provider (CSP) based on the sort of information they would be handling and the service they would provide to the government. They are classified across three axes: confidentiality, integrity, and availability.

FedRAMP as a program has been through a lot over the years it has existed. Different authorization paths, different requirements and standards, multiple rounds of streamlining and changes; it's been a rocky road. Things are starting to smooth out now that FedRAMP 20x is broadly available, but there's still a lot to learn or to question before you can be fully up to speed. So, let's talk about authorization and where we stand today.